Privacy Policy

This page describes how the website available at www.almalivingbologna.com (hereinafter the “Site”) is managed with regard to the processing of the personal data of users who consult it (hereinafter the “data subject” or, collectively, the “data subjects”) and their privacy, setting out the personal data security policy adopted by the property. This notice is provided pursuant to Article 13 of the European General Data Protection Regulation 2016/679 (GDPR) to those who interact with the web services of Alma Living (hereinafter the “Holiday Home”) accessible online from the Site or from its social network pages and, more generally, to all guests of the Holiday Home.

The information and data provided by each guest, as well as those acquired through the use of our web services (hereinafter the “Services”), will be processed in compliance with the provisions of the GDPR and the confidentiality obligations that guide the Controller’s activities.

In accordance with the GDPR, the processing carried out by the Holiday Home will be based on the principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimisation, accuracy, integrity and confidentiality. This notice applies only to the Holiday Home’s Site and not to any other websites the user may visit through shared or advertised links.

1. DATA CONTROLLER
The Data Controller (hereinafter the “Controller”) is:
LCF LIVING S.R.L.
VIA IV NOVEMBRE, 9
40123 BOLOGNA
VAT No. and Tax Code: 04391521202
Mobile: +39 379 3834628
Email: privacy@almalivingbologna.com

2. PERSONAL DATA PROCESSED
Following the browsing of the Site or the consultation of the Holiday Home’s social media pages, please note that the Controller will process personal data such as name, postal address, email address and telephone number in a manner that makes the data subject identified or identifiable (hereinafter “Personal Data”). More specifically, the Personal Data processed through the Site are the following:

– Browsing data
During their normal operation, the computer systems and software procedures used to run the Site acquire certain Personal Data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified data subjects, but by its very nature it could allow users to be identified through processing and association with data held by third parties.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the Site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server’s response (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment. These data are used solely to obtain anonymous statistical information on the use of the Site, to check that it is working correctly and to identify anomalies and/or abuse, and are deleted immediately after processing. In the event of cybercrimes against the Site or third parties, these data may be used to establish liability. Except in this case, the data collected by the Site are removed within a short period of time.

– Special categories of personal data
Sending specific requests or information by email (or by filling in online forms), such as dietary habits or allergies, may involve providing Personal Data falling within the special categories referred to in Article 9 of the GDPR, i.e. “(…) personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and (…) genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation (…)”. Please do not send us such data unless strictly necessary. Should you decide to share them, these data will be processed solely on the basis of your explicit consent, pursuant to Article 9(2)(a) of the GDPR, and only for the purpose of handling your request. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

– Data voluntarily provided by the user
The optional, explicit and voluntary sending of emails or messages to the addresses indicated on the Site (including instant messaging systems via email address) entails the subsequent acquisition of the sender’s address, which is necessary to respond to requests, as well as any other personal data contained in the communication/message.
When using certain Services of the Site (for example, the request/contact/booking form), Personal Data of third parties sent by you to the Controller may be processed. In such cases, the user acts as an independent controller and therefore assumes all the resulting legal and regulatory obligations and responsibilities. In this respect, the user fully indemnifies the Controller against any dispute, claim, request for compensation for damage arising from processing, etc. that may be brought against the Controller by third parties whose Personal Data have been processed through the user’s use of the Site’s functions in breach of the applicable data protection rules. In any case, should the user provide or otherwise process Personal Data of third parties when using the Site, the user guarantees from now on – assuming all related responsibility – that this specific processing is based on an appropriate legal basis under Article 6 of the GDPR which legitimises the processing of the information in question.

3. PURPOSES OF PROCESSING
Users’ personal data, freely provided and acquired through the use of the Site’s Services and hospitality at the Holiday Home, will be processed for the following purposes:

1. Booking the Holiday Home;
2. Responding to requests for assistance, sending quotes and information about the property;
3. Booking additional services (guides, shows, tickets at other venues, taxis, etc.) at guests’ request;
4. Fulfilling legal, accounting and tax obligations;
5. Sending newsletters and marketing activities relating to the Holiday Home.

Personal Data will also be processed for the purposes set out in the anti-money laundering legislation in force (Legislative Decree 231/2007 as amended) and will be kept up to date, complete and not excessive in relation to the purposes listed above for which they are collected and subsequently processed. Other purposes relate to ordinary administrative, commercial and marketing activities.

4. LEGAL BASIS AND NATURE OF PROCESSING
The provision of Personal Data is necessary for the purposes set out in Article 3 above (points i, ii and iii), and the legal basis for processing is Article 6(1)(b) of the GDPR (performance of a contract or pre-contractual measures), as such processing is necessary to provide the Services or to respond to requests made by the data subject. Providing Personal Data for these purposes is optional, but failure to do so would make it impossible to activate the Services provided by the Site and to respond to requests. The legal basis for the processing referred to in Article 3, point iv) is Article 6(1)(c) of the GDPR, i.e. compliance with a legal obligation. Once the Personal Data have been provided, such processing is necessary to comply with a legal and/or regulatory obligation to which the Controller is subject. Finally, for the purposes referred to in Article 3, point v), pursuant to Article 6(1)(a) of the GDPR, the data subject’s consent is required, which is optional and may be withdrawn at any time.

5. RECIPIENTS OF PERSONAL DATA
Personal Data will be processed by the Data Controller and by persons strictly authorised by it. They may also be disclosed to the following parties (hereinafter “Recipients”):

1. individuals, companies or professional firms providing assistance, advice or collaboration to the Data Controller in accounting, administrative, tax, legal, fiscal and financial matters;
2. public administrations for the performance of their institutional functions within the limits established by law or regulations, and third-party service providers to whom disclosure is necessary for the performance of the services covered by the contract;
3. inspectors or other personnel responsible for audits (if requested), including all inspection bodies responsible for checks and controls on compliance with legal obligations;
4. persons appointed to carry out technical maintenance (including maintenance of PCs – hardware and software, network equipment and electronic communication networks);
5. persons authorised by the Controller to process Personal Data where necessary to carry out activities strictly related to the provision of the Services or to the other purposes set out in Article 3 above, who have committed themselves to confidentiality or are under an appropriate legal obligation of confidentiality (such as, for example, the Controller’s family members).

Personal Data are processed by means of the operations listed in Article 4(2) of the GDPR, namely: collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, restriction, disclosure, erasure and destruction of data. Personal Data are processed both on paper and electronically and/or by automated means. Personal Data processed for the purposes referred to in Article 3, points i), ii) and iii) will be kept for as long as strictly necessary to achieve those purposes. In any case, as this processing is carried out to provide Services, the Controller will process Personal Data for as long as permitted by Italian law to protect its own rights and interests (pursuant to Articles 2946 et seq. of the Italian Civil Code). Personal Data processed for the purposes referred to in Article 3, point iv) will be kept for the period required by the specific applicable legal obligation or provision. Personal Data processed for the purposes referred to in Article 3, point v) will instead be kept in compliance with the principle of proportionality and, in any case, until the purposes of the processing have been achieved or, if earlier, until the data subject withdraws consent.

8. SOCIAL MEDIA NETWORKS
The data subject is free to share their Personal Data on any of the many social media platforms on the web through the relevant plug-in integrated into the sites. Please remember, however, that social media are not subject to our privacy policy. When you access the Site through a social media account or share information through a plug-in linked to a social network, your Personal Data are collected, used and shared directly by the social media platforms in accordance with their own privacy policies, which we invite everyone to read and check carefully before logging in or sharing. In this regard, we would like to point out that, in accordance with these policies, the data subject’s activities on the Site may be shared with and viewed by other users of the social network through which they have chosen to register and/or log in to our Services.

9. RIGHTS OF DATA SUBJECTS
Pursuant to Articles 15 to 22 of the GDPR, the data subject is informed that they have the right to:

1. obtain confirmation as to whether or not Personal Data concerning them exist and have them communicated in an intelligible form, pursuant to Article 15 of the GDPR;
2. obtain information on the source of the Personal Data, the purposes and methods of processing and the logic applied in the case of processing carried out with the aid of electronic tools;
3. obtain the rectification or completion of the data concerning them (Article 16 of the GDPR) and the restriction of processing in the cases referred to in Article 18 of the GDPR;
4. obtain the erasure of the data (Article 17 of the GDPR) or their anonymisation, in particular where the data are processed in breach of the law or are no longer necessary for the purposes for which they were collected or subsequently processed;
5. obtain data portability (Article 20 of the GDPR);
6. object, in whole or in part (Article 21 of the GDPR):
   
   1. on legitimate grounds, to the processing of data concerning them, even if relevant to the purpose of collection;
   2. to the processing of personal data concerning them for the purposes of commercial information, sending advertising material or direct selling, or carrying out market research or commercial communication;
7. withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3) of the GDPR).

In any case, the data subject always has the right to lodge a complaint with the competent supervisory authority (the Italian Data Protection Authority – Garante per la Protezione dei Dati Personali), pursuant to Article 77 of the GDPR, if they consider that the processing of their Personal Data infringes the regulations in force, following the procedures and instructions published on the Authority’s official website at www.garanteprivacy.it.

10. HOW TO EXERCISE YOUR RIGHTS
The rights listed in section 9 above may be exercised by sending the necessary communications to the following addresses:

• PEC (certified email): lcfliving@pec.it
• Email: privacy@almalivingbologna.com

The Controller reserves the right to amend or simply update, in whole or in part, the content of this Privacy Policy, including as a result of changes in the applicable legislation in force. The content of the Site and of this Privacy Policy may be subject to change; the Controller therefore invites data subjects to visit this section regularly to view the most recent and up-to-date version of this Policy, so as to always be informed about the data collected and how they are used.